ZeroTrace AirLeak Pro
Wi-Fi Ops
The active Wi-Fi testing tools, and when to use each
The Wi-Fi Ops run on the Pro's dedicated Wi-Fi co-processor. Each is controlled from the app and reports live status while it runs.
Every tool on this page transmits or captures traffic. Use them only against infrastructure you own or are contracted to test, within your agreed scope, with authorization on file.
Beacon
Broadcasts one or more test access-point beacons. Used to observe how client devices react to particular network names, to test whether a monitoring system notices unexpected SSIDs appearing, and for awareness demonstrations. You can broadcast a defined list of names or a set of generated ones, as open or secured networks.
Use it to: test client behaviour, exercise rogue-AP detection, run awareness demos.
Deauth
Sends deauthentication / disassociation frames to test how a network and its clients handle connection disruption, and to validate that a defense (like PMF, protected management frames) actually holds. You target a specific access point and, optionally, a specific client.
Use it to: verify PMF/management-frame protection, test client reconnection behaviour, validate wireless IDS/IPS response, all against gear you control.
Modern networks with protected management frames (WPA3, or WPA2 with PMF) are resistant to deauthentication. Confirming that is often the point of the test.
Deauth detector
A passive counterpart, it watches the air for deauth/disassoc frames and reports the sources sending them, ranked by volume, with an indicator for broadcast-style attacks. This is a defensive tool: use it to detect whether someone is running a deauth attack in an environment you're monitoring.
Use it to: catch active deauth attacks, monitor an environment for wireless disruption.
Handshake capture
Passively captures the WPA handshake when a client joins a target network you're auditing, and saves the frames to a standard .pcap on the microSD card. You then run an offline password-strength audit against that capture with your own tools. It tracks handshake progress live so you know when you have a complete capture.
Use it to: audit the password strength of a network you're authorized to assess, offline, against the capture.
Captive portal
Stands up a captive-portal access point, the "sign in to Wi-Fi" page, for social-engineering and awareness assessments. You can supply a custom page and choose what happens after a submission. Connected clients and any submitted form data are reported to the app, and the portal makes an OS guess for each client to tailor the experience.
Use it to: run authorized phishing/awareness assessments and measure how users respond.
A captive portal can collect what people type. Only run one under explicit authorization, handle any captured data per your engagement rules and applicable privacy law, and dispose of it properly afterwards.
Drone Remote ID
Broadcasts a standards-based drone Remote-ID beacon (operator ID, location, altitude) for testing Remote-ID receivers and detection systems. It's a transmitter-side test tool, useful to anyone building or validating drone-detection infrastructure.
Use it to: exercise and validate Remote-ID receivers and counter-drone detection.
Raw capture (pcap)
Forwards raw 802.11 frames to a standard .pcap file on the microSD card for analysis in Wireshark or similar. This is the general-purpose "record what's in the air" capture for deeper offline work.
Use it to: capture Wi-Fi traffic for offline protocol analysis.
The Wi-Fi Ops share the co-processor with survey scanning, so an active transmitting Op pauses harvesting while it runs. Run one at a time; the app shows what's active.